Senior Application Security Engineer

Own application security across the software development lifecycle by partnering with engineering, architecture, and security teams to reduce risk in PowerSchool products and services.

Responsibilities

• Collaborate with development, architecture, product, and DevOps teams to integrate security across the software development lifecycle.
• Lead threat modeling for new and existing applications to identify attack vectors, security risks, and required security controls.
• Conduct secure architecture and design reviews to surface security weaknesses and recommend mitigations early.
• Provide engineering guidance on secure coding practices, application security risks, and security requirements.
• Run and support application security testing programs, including SAST, DAST, SCA, secret scanning, and related technologies.
• Analyze, validate, prioritize, and communicate application security findings to development teams and other stakeholders.
• Work with engineering teams to develop remediation plans and track issues through resolution.
• Define and continuously improve application security standards, secure coding requirements, and secure development lifecycle processes.
• Evaluate third-party software components, open-source dependencies, and software supply chain risks.
• Support software bill of materials (SBOM) initiatives and software supply chain security activities.
• Develop security requirements, security patterns, and implementation guidance for web applications, APIs, cloud-native applications, and supporting services.
• Coordinate with Offensive Security Engineers to review penetration test results and drive corrective actions when appropriate.
• Design and deliver application security training, awareness content, and developer enablement programs.
• Support security champions and other engineering security advocate programs.

Requirements

• 5+ years of experience in application security, software security, secure software development, DevSecOps, software engineering, or a related discipline.
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Software Engineering, or a related field; or equivalent combination of education, training, and experience.
• Experience performing threat modeling, secure design reviews, and application security assessments.
• Experience identifying and mitigating common web application and API vulnerabilities, including those listed in OWASP Top 10 and OWASP API Security Top 10.
• Experience supporting application security testing technologies, including SAST, DAST, SCA, secret scanning, and related security tooling.
• Strong understanding of secure coding principles, software architecture, and secure development practices.
• Knowledge of authentication, authorization, session management, cryptography, API security, and software supply chain security concepts.
• Experience working with development teams to remediate security findings and implement secure solutions.
• Familiarity with modern software development methodologies, CI/CD pipelines, and DevOps practices.
• Knowledge of cloud technologies and security concepts in AWS and/or Microsoft Azure environments.
• Strong analytical, communication, presentation, and stakeholder management skills.
• Ability to explain technical security concepts effectively to developers, engineers, and business stakeholders.

Technologies

• SAST, DAST, SCA, secret scanning, SBOM
• OWASP Top 10, OWASP API Security Top 10
• AWS, Microsoft Azure
• CI/CD pipelines
• Java, C#, JavaScript, TypeScript, Python, Go
• NIST Secure Software Development Framework (SSDF), OWASP SAMM
• CISSP, CSSLP, GWAPT, GWEB, OSWE, Security+
• Azure Security Engineer Associate, AWS Security Specialty
• Kubernetes, SaaS
• DevSecOps

Benefits

• Comprehensive Insurance Coverage (Medical, Dental, Vision, Pharmacy benefits, Life Insurance, and AD&D)
• Flexible Spending Accounts and Health Savings Accounts
• Short-Term Disability and Long-Term Disability
• Comprehensive 401(k) plan
• Generous Parental Leave
• Unrestricted paid time off (Discretionary Time Off - DTO)
• Wellness Program, including ClassPass & Employee Assistance Program
• Tuition Reimbursement
• Optional Benefits: Pet Insurance, Identity Theft Protection, Student Debt Repayment Program, Prepaid Legal coverage

Preferred Qualifications

• Experience working within a SaaS, cloud-native, software development, or technology organization.
• Experience serving as an application security engineer within a mature Product Security or DevSecOps program.
• Experience with software development languages such as Java, C#, JavaScript, TypeScript, Python, Go, or similar technologies.
• Experience developing secure development lifecycle (SDLC) processes, standards, and governance frameworks.
• Experience conducting manual secure code reviews and identifying security weaknesses in application source code.
• Experience supporting software supply chain security initiatives, including SBOM generation, dependency management, and open-source risk management.
• Experience with container security, Kubernetes security, cloud-native application security, and API security.
• Familiarity with threat intelligence, penetration testing, offensive security practices, and vulnerability management programs.
• Experience implementing or supporting security champions programs and developer security training initiatives.
• Familiarity with NIST SSDF, OWASP SAMM, or similar software security frameworks.
• Industry certifications such as CISSP, CSSLP, GWAPT, GWEB, OSWE, Security+, Azure Security Engineer Associate, AWS Security Specialty, or equivalent.

Location

• Plano, TX (onsite)

EEO Commitment: PowerSchool is committed to a diverse and inclusive workplace and is an equal opportunity employer.